Commit Graph

1902 Commits

Author SHA1 Message Date
momo5502
bb79b45f13 Set library path 2025-08-16 12:40:16 +02:00
momo5502
5ffff265d3 Fix macos build 2025-08-16 12:21:31 +02:00
momo5502
397db6decc Fix print 2025-08-16 11:53:44 +02:00
momo5502
3b72ae9709 Add capstone disassembler 2025-08-16 11:53:40 +02:00
momo5502
f12fd47d1d Log transitions to foreign code 2025-08-15 15:30:08 +02:00
momo5502
127ed1b552 Log rdtsc 2025-08-15 12:54:36 +02:00
momo5502
6584eaaff5 Support downloading files 2025-08-15 09:42:27 +02:00
Maurice Heumann
5bea61fc3b Update README.md 2025-08-15 08:31:38 +02:00
Maurice Heumann
4760247dd6 Update settings.ts 2025-08-14 20:39:51 +02:00
momo5502
bfb874662f Cache access in concise mode 2025-08-14 19:15:27 +02:00
momo5502
ee679dcd0a Log ldr access 2025-08-14 18:38:11 +02:00
momo5502
73000c8d22 Log foreign memory access 2025-08-14 17:03:39 +02:00
momo5502
e10df224a7 Log accessed size 2025-08-13 20:58:48 +02:00
momo5502
3189e6f701 Log more interesting things if outside any mapped module 2025-08-13 19:50:04 +02:00
momo5502
982d02b674 Log invocations outside of any module 2025-08-13 19:09:44 +02:00
momo5502
a33e252e40 Kill WinVerifyTrust 2025-08-13 19:06:18 +02:00
momo5502
23001dcbab Allow specifying commandline options 2025-08-12 21:04:33 +02:00
momo5502
2681c7c97e Overflow fix 2025-08-10 17:33:26 +02:00
momo5502
d73445d868 Support interesting modules and ignored functions 2025-08-10 17:07:00 +02:00
momo5502
832570edda Support ignored functions and interesting modules 2025-08-10 12:43:49 +02:00
momo5502
f9cee1837c Print compare input 2025-08-10 12:43:35 +02:00
momo5502
94687d73fe Small fixes 2025-08-10 11:18:05 +02:00
momo5502
5fbf065937 Handle debug strings via callback 2025-08-10 10:03:12 +02:00
momo5502
74bff93580 Print on unknown exception 2025-08-10 08:40:29 +02:00
momo5502
b980ff6277 Fix crash is module is nullptr 2025-08-10 08:37:02 +02:00
momo5502
fc9a240d9f Update project name 2025-08-10 07:58:38 +02:00
momo5502
806aa8b61b Print module name 2025-08-09 21:56:25 +02:00
momo5502
93ff52c2ec Fix ordinals 2025-08-09 21:36:40 +02:00
Maurice Heumann
49764b46c4 More diagnostics and fixes (#446) 2025-08-09 21:17:54 +02:00
momo5502
9e45d2a333 Fix warning 2025-08-09 21:00:10 +02:00
momo5502
b3bdfc9d6b Support hooking/unhooking within hooks for icicle 2025-08-09 20:45:05 +02:00
momo5502
3b9320fd62 Better import access tracking 2025-08-09 18:02:37 +02:00
momo5502
2abe1737f3 Fix android compilation 2025-08-09 17:42:33 +02:00
momo5502
292fc6ce67 Fix compilation 2025-08-09 17:38:20 +02:00
momo5502
eb07148bfd Support hook deletion during hook deletion 2025-08-09 17:23:58 +02:00
momo5502
386f5b1cbc Add missing types 2025-08-09 17:20:22 +02:00
momo5502
eb6d352a81 Track import access 2025-08-09 17:07:33 +02:00
momo5502
09ad463027 Support environment analysis 2025-08-09 14:06:06 +02:00
Maurice Heumann
50d9cba542 fix: handle two invalid VirtualAlloc/Free edge cases correctly (#445)
Fixes #421 

Ensures sogen handles two edge cases correctly:

- VirtualAlloc with size 0 and invalid flags now returns
STATUS_INVALID_PARAMETER instead of terminating emulation with an
exception.
- VirtualFree with an invalid free_type now fails cleanly, as per
Windows behavior.

Using test code from #421  before change:

Executing syscall: NtAllocateVirtualMemory (0x18) at 0x180162bb2 via
0x103858074 (KernelBase.dll)
Syscall threw an exception: 18 (0x180162bb2) - Unsupported allocation
type!
Emulation terminated without status!

After:

Executing function: kernel32.dll - VirtualAlloc (0x103703c90) via
(0x14000119a) Valloc.exe
Executing syscall: NtAllocateVirtualMemory (0x18) at 0x180162bb2 via
0x103858074 (KernelBase.dll)
Executing function: kernel32.dll - GetLastError (0x1036e8640) via
(0x1400011a5) Valloc.exe

Terminating normally:

Emulation terminated with status: 0
2025-08-08 16:42:27 +02:00
CarlTSpeak
3df8d100cd Merge branch 'momo5502:main' into 421-valloc 2025-08-08 14:54:27 +01:00
CarlTSpeak
051cef2212 fix: handle VirtualAlloc invalid size and flags 2025-08-08 14:52:03 +01:00
Maurice Heumann
2aa0d1c4a8 Add stub for NtReleaseWorkerFactoryWorker, skeleton implementation for NtCreateNamedPipeFile (#444)
Added a stub implementation for NtReleaseWorkerFactoryWorker.

Introduced initial skeleton logic for NtCreateNamedPipeFile with device
creation and registration, object attribute parse for pipe naming, basic
parameters to named_pipe structure, IOSB and handle writing.
2025-08-08 14:30:37 +02:00
CarlTSpeak
0aea1f5385 I just learned how clang-format works. Fail. 2025-08-08 11:22:56 +01:00
CarlTSpeak
210ab2930c Fixed platform portability issues 2025-08-06 11:12:44 +01:00
CarlTSpeak
8b2c170236 Fixed clang exception. Again. 2025-08-06 11:01:42 +01:00
CarlTSpeak
ffea72d48a Added basic pipe support to NtRead/WriteFile 2025-08-06 10:30:40 +01:00
CarlTSpeak
100638d8ea Fixed clang-tidy issue 2025-08-05 16:26:13 +01:00
CarlTSpeak
85843ff5c9 Fixed cross-platform: removed MS-specific macro 2025-08-05 15:55:36 +01:00
CarlTSpeak
5f9bfd4694 Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:44:19 +01:00
CarlTSpeak
cae1cf5c1f Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker 2025-08-05 15:35:31 +01:00